I've been inside organizations when the call comes in. "We think we had a breach." The next sentence is almost always the wrong one — either someone starts talking to the IT vendor about what happened, or someone drafts a customer email, or someone calls the insurance company without reading the policy. Each of those actions, taken before counsel is engaged, can cost more than the breach itself.
A data breach creates simultaneous obligations running in different directions: legal holds, regulatory notifications, contractual obligations to business partners, insurance notice requirements, and potential civil liability to affected individuals. None of them can be managed reactively. The businesses that get through a breach with minimum liability are the ones that treated it as a legal event from the moment of discovery — not a technology problem or a communications problem that legal would eventually review.
What follows is the sequence: what happens at each stage, what the legal obligations are, and what the structural decisions are that can't be revisited once made.
The response clock
Breach response has three distinct time bands. Each has its own obligations, its own cost drivers, and its own decision points. The terracotta dots mark items with specific legal consequences if missed. The brass dots mark operationally critical actions that aren't legally mandated but determine the trajectory of the response.
Legend
Legal obligation — specific consequences if missed
Operationally critical — shapes the trajectory
First 4 Hours
Contain, preserve, and make the structural choice
Call outside counsel — before any other vendor
This is the sequence decision. Counsel engaged first means the investigation can be structured to protect privilege. Counsel engaged after the IT team has already started the forensic work means that work is not privileged. Do not brief your internal team broadly, do not notify your IT vendor, do not call your insurance company, and do not draft any customer communication before counsel is on the phone.
Issue a litigation hold
A written instruction to preserve all documents, communications, logs, and system records related to the incident. Issued the moment litigation is reasonably anticipated — which is at discovery, not after notification. Destruction of evidence after a litigation hold should have been issued is spoliation. Courts treat it severely in subsequent proceedings.
Contain the incident — without destroying evidence
The IT team's instinct is to wipe and rebuild affected systems. In a breach response, that instinct is wrong: those systems contain the forensic evidence that establishes scope, root cause, and attribution. Containment means isolating affected systems from the network without wiping them, preserving logs, and capturing volatile memory where possible. Forensic investigators retained through counsel will direct this process.
Notify your cyber liability insurer
Most cyber policies have prompt notice requirements — some as short as 24–72 hours. Late notice can void coverage. Locate your policy before a breach happens; know the notice deadline and the notification mechanism. The insurer may have pre-approved vendors for forensics and counsel, and using unapproved vendors can affect coverage.
Hours 4 – 72
Investigate scope, assess obligations, manage the circle
Engage forensic investigators through counsel
The forensic team's engagement letter should run to counsel, not directly to the business. They report to counsel. Their findings are communicated through counsel. This structure is what makes their report potentially privileged as attorney work product. The forensic report is the document that most directly drives liability in breach litigation — it documents exactly what happened, what data was compromised, and what security failures enabled the breach.
Assess the scope of affected data — systematically
What type of data was accessed or exfiltrated? Names alone don't trigger notification. Names combined with Social Security numbers, financial account numbers with access codes, or health information do — under Texas law. Names with driver's license numbers do. The scope assessment determines which notification obligations apply, to how many individuals, and under which laws.
Identify which notification laws apply
Texas Chapter 521 governs notification to Texas residents. HIPAA governs if health data is involved. GLBA Safeguards Rule governs if financial institution data is involved. PCI DSS contractual obligations apply if cardholder data is compromised. Multiple obligations may run simultaneously with different deadlines. The notification obligation analysis is a legal determination, not an IT one — it requires counsel.
Manage the internal circle — tightly
Every person briefed on the breach is a potential witness. Internal communications about the breach that are not directed through counsel are not privileged and are discoverable. Brief only those who need to know — the incident response team and the relevant executives. All substantive communications about the breach should go through counsel. Slack messages, emails, and texts describing what happened, who knew, and when are evidence.
Review contracts with affected third parties
If the breached data includes customer data, vendor data, or data processed under a service agreement, those contracts likely contain breach notification provisions — some with deadlines as short as 24–72 hours for business-to-business notification. Contractual notification obligations can be shorter than statutory ones. Breach of a contractual notification deadline is itself a breach of contract claim.
Day 3 – 60
Notify, remediate, and document the response
Send breach notification to affected individuals
Texas Chapter 521 requires notification "as expeditiously as possible" and no later than 60 days after determining a breach occurred. The notification letter must include: what happened, what type of data was involved, steps taken to protect individuals, steps individuals can take to protect themselves, and contact information. The letter is reviewed by counsel before it is sent. Unnecessary admissions in a notification letter expand liability exposure.
Notify the Texas Attorney General if 250+ residents are affected
Texas Business and Commerce Code §521.053 requires notification to the Texas AG when a breach affects 250 or more Texas residents, within the same 60-day window. The AG notification must be made simultaneously with, or before, the individual notifications. This filing is public record. Failure to notify carries civil penalties of up to $100 per affected individual, up to $250,000 per breach for unintentional violations.
Remediate — with documentation
Every remediation step taken — patching vulnerabilities, resetting credentials, implementing new controls — should be documented in writing, dated accurately, and retained. In subsequent litigation or regulatory review, the question of what the business did after the breach is as important as what the business did before it. Remediation without documentation looks like remediation never happened.
Prepare for litigation and regulatory inquiry
A breach affecting a meaningful number of individuals typically generates demand letters or class action filings within 30–90 days of notification. Regulatory inquiries from the Texas AG, the FTC, or sector-specific regulators can follow. The litigation hold, the counsel-directed forensic investigation, and the documented remediation are the foundation of the defense. Businesses that treated the response as a communications problem rather than a legal one arrive at this stage without that foundation.
Notification obligations by law
Multiple notification regimes often apply to the same breach simultaneously, each with its own trigger, deadline, and required recipient. The matrix below shows the most common frameworks affecting Texas businesses.
Law / Framework
Trigger
Deadline
Who must be notified
Texas Chapter 521
Unauthorized access to sensitive personal information of TX residents
60 days from determination
Affected individuals; TX AG if 250+ residents
HIPAA Breach Rule
Breach of unsecured protected health information
60 days (individuals + HHS); immediate media notice if 500+ in a state
Affected individuals; HHS; media if 500+ in a state
GLBA Safeguards Rule
Unauthorized access to customer financial information
30 days for FTC notice if 500+ customers
FTC; affected customers as soon as reasonably practicable
PCI DSS
Compromise of cardholder data environment
Immediate — typically within 24 hours of discovery
Acquiring bank; card brands (Visa, Mastercard, etc.)
Contractual obligations
Breach affecting data processed under a vendor or service agreement
Per contract — often 24–72 hours
Counterparty named in the agreement
The mistake that defines the response
Most breach response failures trace back to a single decision made in the first hour: the business treats the breach as an IT problem and calls the IT team before calling an attorney. The IT team calls a forensic vendor. The forensic vendor begins its investigation. By the time counsel is engaged, the investigation is underway — and the forensic report is not privileged.
The forensic report is the document that tells the story of the breach. It identifies the attack vector, the duration of the intrusion, the data accessed, and the security controls that failed to prevent it. That story is what plaintiff's attorneys use to build a negligence case and what regulators use to assess penalties. A privileged forensic report can be withheld in litigation. An unprivileged one cannot.
A breach is a legal event before it is a technology event. The first call determines whether the response is protected or exposed.
The practical implication: your incident response plan — which every business handling customer data should have, and which most don't — should identify outside counsel as the first call, above the IT vendor, above the insurer, above the CEO's communications advisor. The sequence is not a technicality. It is the structural decision that determines whether the forensic investigation and the response documents live inside the attorney-client privilege or outside it.
Before the breach happens
Two investments made before a breach occurs determine whether the response is orderly or chaotic. Neither requires significant resources.
The first is a written incident response plan. It should name the response team — who is called first, in what order, and what each person's role is. It should identify outside counsel and the forensic vendor (engaged through counsel) before the incident, not during it. It should document the notification obligations that apply to your business based on the data you hold. And it should include the cyber insurance policy number and the insurer's breach notification contact. A business that discovers a breach at 11pm on a Friday and has to locate all of this information in real time will lose the first four hours to logistics rather than response.
The second is cyber liability insurance appropriately sized to the business's data exposure. A breach affecting several thousand customer records — routine in scale — can cost $150,000–$400,000 in notification, forensics, credit monitoring, and regulatory defense before a single civil claim is filed. That is not a cost most small and mid-sized Texas businesses can absorb from operations. Cyber coverage is the mechanism that makes a manageable incident out of one that would otherwise be existential.